Dagda
Dagda is a free, self-hosted Docker security tool for examining images and containers for vulnerabilities, malware, and other threats, while monitoring runni…
What Dagda is
Dagda is a free, self-hosted Docker security tool for examining images and containers for vulnerabilities, malware, and other threats, while monitoring running containers for anomalous activity. It checks operating-system packages and programming-language dependencies against vulnerability and exploit data stored in MongoDB. ClamAV scans images and containers for malicious threats, while Falco integration monitors runtime behavior and collects Docker daemon events. Dependency analysis covers Java, Python, Node.js, JavaScript, Ruby, and PHP through OWASP Dependency-Check and Retire.js. Listed Linux base images include Red Hat, CentOS, Fedora, Debian, Ubuntu, OpenSUSE, and Alpine. Static-analysis and runtime reports remain in MongoDB for later history review. Dagda offers both a command-line interface and REST API. Requirements include Python 3.8 or later, MongoDB 3.6 or later, Docker, pip3, and host kernel headers for Falco monitoring. A documented Docker Compose setup runs MongoDB and Dagda with a shared Docker socket. The project is licensed under Apache-2.0.
Good
- Scans images and containers for vulnerabilities
- Uses ClamAV for malware detection
- Falco provides runtime monitoring
- Supports CLI and REST API access
- Stores reports and history in MongoDB
Watch out
- Requires Python 3.8 or later
- Requires MongoDB and Docker
- Falco monitoring needs host kernel headers
- Self-hosted deployment requires infrastructure
Who it suits
Dagda suits teams managing Docker images and containers in a self-hosted environment. It is aimed at users who need vulnerability, malware, dependency, and runtime monitoring.
Verdict
Dagda combines image analysis, malware scanning, dependency checks, and runtime monitoring in a self-hosted Docker setup. Its requirements make it most suitable for teams prepared to operate MongoDB, Docker, and related monitoring components.
The facts
Each one read from Dagda's own pages, with the date it was checked.
What it does
- Base images
- The README lists Red Hat/CentOS/Fedora, Debian/Ubuntu, OpenSUSE, and Alpine as supported Linux base images.checked 4 Oct 2026
- Dependency coverage
- The README lists Java, Python, Node.js, JavaScript, Ruby, and PHP dependencies for analysis using OWASP Dependency-Check and Retire.js.checked 9 Oct 2026
- Deployment
- The README describes running Dagda as a server and provides a Docker Compose setup with MongoDB and a Dagda container.checked 9 Oct 2026
- Deployment requirements
- The listed requirements include Python 3.8 or later, MongoDB 3.6 or later, Docker, and host OS kernel headers for Falco monitoring.checked 4 Oct 2026
- Docker deployment
- The README describes a Docker Compose setup with MongoDB and Dagda containers and a shared Docker socket.checked 4 Oct 2026
- Interfaces
- Dagda can be used through its CLI and has a REST API.checked 9 Oct 2026
- License
- The GitHub repository identifies its license as Apache-2.0.checked 9 Oct 2026
- Malware detection
- It uses ClamAV to detect trojans, viruses, malware, and other malicious threats in Docker images and containers.checked 4 Oct 2026
- Malware scanning
- Dagda uses ClamAV to detect trojans, viruses, malware, and other malicious threats in Docker images and containers.checked 9 Oct 2026
- Purpose
- Dagda performs static analysis of Docker images and containers for known vulnerabilities and malicious threats, and monitors running containers for anomalous activities.checked 9 Oct 2026
- Report history
- Analysis reports, including static analysis and runtime monitoring, are stored in MongoDB for later review.checked 9 Oct 2026
- Reports
- Analysis reports, including static analysis and runtime monitoring, are stored in MongoDB so image and container history can be reviewed.checked 4 Oct 2026
- Requirements
- The README requires Python 3.8 or later, MongoDB 3.6 or later, Docker, and pip3.checked 9 Oct 2026
- REST API
- The README says Dagda has a REST API in addition to its command-line interface.checked 4 Oct 2026
- Runtime monitoring
- Dagda integrates with Falco to monitor running Docker containers and gathers real-time events from the Docker daemon.checked 9 Oct 2026
- Runtime prerequisite
- The README says host OS kernel headers are required for Falco-based monitoring and notes that Sysdig installation may be needed on some distributions.checked 9 Oct 2026
- Support
- The README directs users to GitHub Issues or the author's Twitter account for bugs, questions, and discussions.checked 9 Oct 2026
- Supported image bases
- The README lists Red Hat/CentOS/Fedora, Debian/Ubuntu, OpenSUSE, and Alpine as supported Linux base images.checked 9 Oct 2026
- Vulnerability analysis
- It checks installed OS packages and programming-language dependencies against vulnerability and exploit data stored in MongoDB.checked 9 Oct 2026
Alternatives to Dagda
- 1
Mondoo CSPM
Free planOpen sourceWebAPIExtensionLinux7.7Free plan - 2
Grype
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.4Free plan - 3
Sysdig Secure
WebAPILinuxmacOS7.2From $20 a month - 4
Alibaba Cloud Container Registry
Free planWebAPILinuxWindows7.1Free plan - 5
Trivy
Free planLinuxmacOSSelf-hostedWindows7.0Free plan - 6
ZeroPath
WebAPILinuxmacOS6.5From $1,000 a month